<?php
    session_start();
    if (isset($_SESSION['login_msg'])) {
        echo "<script>alert('" . $_SESSION['login_msg'] . "');</script>";
        unset($_SESSION['login_msg']); // remove message after showing
    }
    require_once("./include/config.php");       
    
    if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = $_POST['txt_username'];
    $password = $_POST['txt_password'];
       
    $sql = "SELECT * FROM mst_user WHERE username = ?";
    $stmt = $conn->prepare($sql);
    $stmt->bind_param("s", $username);
    $stmt->execute();
    $result = $stmt->get_result();
    $user = $result->fetch_assoc();

    // Direct comparison since passwords are stored in plain text (not secure)
    if ($user && $password === $user['password']) {         
        $_SESSION['company_id'] = $user['cmp_id'];
        $_SESSION['user_id'] = $user['id'];
        $_SESSION['username'] = $user['username'];
        header("Location: index.php");
        exit();
    } else {
        echo "<script>alert('Invalid username or password'); window.location.href='login.php';</script>";
    }
}


    include_once('login1.html');  
?>    